Competition among cyber criminals is so fierce that they now have customer support, service guarantees, and other perks

REUTERS / Samantha Sais
The digital-criminal underground can be intensely competitive. Cyber criminals are constantly finding new ways to extort money or information from their unsuspecting victims and crafting new software to stay ahead of the curve.

Hackers are offering customer service and support, guarantees, and custom features to attract criminal customers and differentiate themselves from their competitors.

"[Cyber criminals] have a very crowded market and they are competing with themselves," Ed Cabrera, vice president of cybersecurity strategy at Trend Micro, told Business Insider.

A carder claims that all of his cards are verified and guaranteed to work.
Verified Carder/Screengrab
According to Cabrera, Trend Micro is now seeing customer support functionality in nearly all cyber-criminal undergrounds the company researches.

Support and service are particularly important to sellers whose market is comprised of relatively inexperienced hackers who may need some degree of hand-holding.

Carders went first

Some of the first cyber criminals to adopt this line of thinking were "carders," those who sell stolen credit-card info. After the shutdown of several major carding operations and forums in the early 2000s, market forces kicked in as new upstarts sought to make themselves more noticeable. Soon enough, carders were frequently verifying cards with test donations to charities and even offering money-back guarantees to their customers.

The idea has since caught on.

Cyber criminals advertise an "80%+ working guarantee" on purchases of credit cards, PayPal, and eBay accounts.Trend Micro
"You name the service or product and you have high specialization [in that market]," Cabrera said. "Customer service is just a natural effect of that."

Brian Krebs, a journalist who has written extensively on cybercrime, echoed Cabrera's statements in an email to Business Insider.

"Those who profit are the ones who manage to develop strong customer service models," wrote Krebs. "Those who screw this up — whether they're renting some kind of malware as a service setup or rolling their own — are not going to be successful in the long term."

Virus developers often seem to offer perks out of a sense of hacker camaraderie and general goodwill toward their customers, if not their victims.

Often, hackers deploying a virus will share tips with others doing the same or offer suggestions to the original author on how to improve the service.

A feedback form on Encryptor RaaS, a ransomware service by Jeiphoos.
Encryptor RaaS/Screengrab

In addition to asking questions about his service, users have given Jeiphoos feature requests, requests for custom-webpage templates or ransom notes, and inquiries about virus detection. Some write just to say thank you. He responds to them when they leave him an address to reach them at and even posts on forum threads discussing his software, seeking out improvements and verifying his identity to establish trust.

Jeiphoos said that he occasionally implements features recommended by customers looking to improve the service or tweak the software for a given user's needs, like providing a white-label version with no Encryptor branding.

Positive reviews of Encryptor RaaS, some claiming to have made money, despite the fact that no ransoms had ever been paid through the service when the reviews were written.
Onion Dir/Screengrab
But Encryptor is free for anyone to use and Jeiphoos doesn't make a cent unless the ransom is paid, in which case he gets a cut. Asked why he provides free support to his "customers" before they've earned him any money, Jeiphoos compared himself to an employee in an ordinary store helping potential shoppers.

"Others have called me [selfless] in my 'non-criminal' side of life," Jeiphoos said. "I almost plead [with] them to stop saying that."

As Tox's service became more popular, a community evolved in a chat room on his site.

"At the beginning I had to answer questions and help users, but after a few days my users were helping each other and I just had to answer ... private messages," Tox told Vocativ in June.

In an effort to help users find legitimate services, some dark-web marketplaces offer the ability to leave seller and item reviews. The result ends up looking like an eBay seller's feedback page.

'Excellent vendor, great communication, thx bro!'

A dark-web marketplace called AlphaBay not only offers seller reviews but "vendor levels," indicating how much business a seller has done on the site, and "trust levels" to help gauge a seller's honesty. The site also features an active forum where users discuss products and individual sellers, get help with using the site, and report scammers. For even more convenience, moderators for the site are assigned to help handle disputes.

An overview of the feedback given to a seller on the dark-net market AlphaBay.
AlphaBay/Screengrab

In the scam report forum, one user has just reported receiving two packets of flour in a shipment that should have contained a Beretta pistol. In another thread, a seller accused of scamming intervenes to mention that he offered a refund. Even more incredibly, AlphaBay will offer refunds to buyers in instances where the seller has been banned.

One seller on AlphaBay describes himself as a "friendly guy" who does his best to "keep you satisfied and help" and has 92% positive feedback for his efforts. In his listing for customizable ransomware, he mentions that he will set the service up for customers for a small fee.

"Excellent vendor, great communication, thx bro!!!" one user wrote on the seller's feedback page.

The vendor leaves a reply: "No problem, have fun mate!"

The exchange might look like any ordinary eBay feedback comments, except this sale was for "fullz" — personal information used for identity theft.

When asked about the support he offers, he had a simple response: "It's called hacking, friend. Sharing is the key to power, freedom, and success."